反汇编系列(九) 算法反汇编

#include"stdio.h"
int function(int a[3][3],int b[3][3],int c[3][3])
{
    int i,j;
    for(i=0;i<3;i++)
    {
        for(j=0;i<3;j++)
        {
            c[i][j]=a[i][0]*b[0][j]+a[i][1]*b[1][j]+a[i][2]*b[2][j];
        }
    }
    return 0;
}
void main()
{
    int a[3][3]={1,2,3,4,5,6,7,8,9};
    int b[3][3]={1,2,3,4,5,6,7,8,9};
    int c[3][3]={1,2,3,4,5,6,7,8,9};
    function(a,b,c);
} 

---

--- c:\users\wangchao\desktop\test\test\main.cpp -------------------------------

#include "stdio.h"

int function(int a[3][3],int b[3][3],int c[3][3])

{

00403530 push ebp

00403531 mov ebp,esp

00403533 sub esp,0D8h

00403539 push ebx

0040353A push esi

0040353B push edi

0040353C lea edi,[ebp-0D8h]

00403542 mov ecx,36h

00403547 mov eax,0CCCCCCCCh

0040354C rep stos dword ptr es:[edi]

    int i,j;

    for(i=0;i<3;i++)

0040354E mov dword ptr [i],0

00403555 jmp function+30h (403560h)

00403557 mov eax,dword ptr [i]

0040355A add eax,1

0040355D mov dword ptr [i],eax

00403560 cmp dword ptr [i],3

00403564 jge function+0AEh (4035DEh)

    {

        for(j=0;i<3;j++)

00403566 mov dword ptr [j],0

0040356D jmp function+48h (403578h)

0040356F mov eax,dword ptr [j]

00403572 add eax,1

00403575 mov dword ptr [j],eax

00403578 cmp dword ptr [i],3

0040357C jge function+0A9h (4035D9h)

        {

            c[i][j]=a[i][0]*b[0][j]+a[i][1]*b[1][j]+a[i][2]*b[2][j];

0040357E mov eax,dword ptr [i]                 ;eax=i

00403581 imul eax,eax,0Ch                      ;eax=i*12

00403584 mov ecx,dword ptr [a]                 ;ecx=a

00403587 mov edx,dword ptr [j]                 ;edx=j

0040358A mov esi,dword ptr [b]                 ;esi=b

0040358D mov eax,dword ptr [ecx+eax]           ;eax=a+i*12

00403590 imul eax,dword ptr [esi+edx*4]        ;eax=a[i][0]*b[0][j]

00403594 mov ecx,dword ptr [i]                 ;ecx=i

00403597 imul ecx,ecx,0Ch                      ;ecx=i*12

0040359A mov edx,dword ptr [a]                 ;

0040359D mov esi,dword ptr [j]

004035A0 mov edi,dword ptr [b]

004035A3 mov ecx,dword ptr [edx+ecx+4]         ;ecx=a[i][1]

004035A7 imul ecx,dword ptr [edi+esi*4+0Ch]    ;ecx=a[i][1]*b[1][j]

004035AC add eax,ecx                           ;相加符号

004035AE mov edx,dword ptr [i]

004035B1 imul edx,edx,0Ch                      ;edx=i*12

004035B4 mov ecx,dword ptr [a]                 ;ecx=a

004035B7 mov esi,dword ptr [j]                 ;esi=j

004035BA mov edi,dword ptr [b]                 ;edi=b

004035BD mov edx,dword ptr [ecx+edx+8]         ;a[i][2]

004035C1 imul edx,dword ptr [edi+esi*4+18h]    ;edx=a[i][2]*b[2][j]

004035C6 add eax,edx                           ;相加符号

004035C8 mov ecx,dword ptr [i]

004035CB imul ecx,ecx,0Ch

004035CE add ecx,dword ptr [c]

004035D1 mov edx,dword ptr [j]

004035D4 mov dword ptr [ecx+edx*4],eax

        }

004035D7 jmp function+3Fh (40356Fh)

    }

004035D9 jmp function+27h (403557h)

    return 0;

004035DE xor eax,eax

}

004035E0 pop edi

004035E1 pop esi

004035E2 pop ebx

004035E3 mov esp,ebp

004035E5 pop ebp

004035E6 ret

--- c:\users\wangchao\desktop\test\test\main.cpp -------------------------------

void main()

{

004035F0 push ebp

004035F1 mov ebp,esp

004035F3 sub esp,144h

004035F9 push ebx

004035FA push esi

004035FB push edi

004035FC lea edi,[ebp-144h]

00403602 mov ecx,51h

00403607 mov eax,0CCCCCCCCh

0040360C rep stos dword ptr es:[edi]

    int a[3][3]={1,2,3,4,5,6,7,8,9};

0040360E mov dword ptr [a],1

00403615 mov dword ptr [ebp-24h],2

0040361C mov dword ptr [ebp-20h],3

00403623 mov dword ptr [ebp-1Ch],4

0040362A mov dword ptr [ebp-18h],5

00403631 mov dword ptr [ebp-14h],6

00403638 mov dword ptr [ebp-10h],7

0040363F mov dword ptr [ebp-0Ch],8

00403646 mov dword ptr [ebp-8],9

    int b[3][3]={1,2,3,4,5,6,7,8,9};

0040364D mov dword ptr [b],1

00403654 mov dword ptr [ebp-50h],2

0040365B mov dword ptr [ebp-4Ch],3

00403662 mov dword ptr [ebp-48h],4

00403669 mov dword ptr [ebp-44h],5

00403670 mov dword ptr [ebp-40h],6

00403677 mov dword ptr [ebp-3Ch],7

0040367E mov dword ptr [ebp-38h],8

00403685 mov dword ptr [ebp-34h],9

    int c[3][3]={1,2,3,4,5,6,7,8,9};

0040368C mov dword ptr [c],1

00403693 mov dword ptr [ebp-7Ch],2

0040369A mov dword ptr [ebp-78h],3

004036A1 mov dword ptr [ebp-74h],4

004036A8 mov dword ptr [ebp-70h],5

004036AF mov dword ptr [ebp-6Ch],6

004036B6 mov dword ptr [ebp-68h],7

004036BD mov dword ptr [ebp-64h],8

004036C4 mov dword ptr [ebp-60h],9

    function(a,b,c);

004036CB lea eax,[c]

004036CE push eax

004036CF lea ecx,[b]

004036D2 push ecx

004036D3 lea edx,[a]

004036D6 push edx

004036D7 call function (4011E0h)

004036DC add esp,0Ch

}

004036DF xor eax,eax

004036E1 push edx

004036E2 mov ecx,ebp

004036E4 push eax

004036E5 lea edx,[ (403708h)]

004036EB call @ILT+130(@_RTC_CheckStackVars@8) (401087h)

004036F0 pop eax

004036F1 pop edx

004036F2 pop edi

004036F3 pop esi

004036F4 pop ebx

004036F5 add esp,144h

004036FB cmp ebp,esp

004036FD call @ILT+315(__RTC_CheckEsp) (401140h)

00403702 mov esp,ebp

00403704 pop ebp

00403705 ret

00403706 mov edi,edi

00403708 db 03h

00403709 db 00h

0040370A db 00h

0040370B db 00h

0040370C db 10h

0040370D db 37h

0040370E db 40h

0040370F db 00h

00403710 db d8h

00403711 db ffh

00403712 db ffh

00403713 db ffh

00403714 db 24h

00403715 db 00h

00403716 db 00h

00403717 db 00h

00403718 db 38h

00403719 db 37h

0040371A db 40h

0040371B db 00h

0040371C db ach

0040371D db ffh

0040371E db ffh

0040371F db ffh

00403720 db 24h

00403721 db 00h

00403722 db 00h

00403723 db 00h

00403724 db 36h

00403725 db 37h

00403726 db 40h

00403727 db 00h

00403728 db 80h

00403729 db ffh

0040372A db ffh

0040372B db ffh

0040372C db 24h

0040372D db 00h

0040372E db 00h

0040372F db 00h

00403730 db 34h

00403731 db 37h

00403732 db 40h

00403733 db 00h

00403734 db 63h

00403735 db 00h

00403736 db 62h

00403737 db 00h

00403738 db 61h

00403739 db 00h

---

读取数组整体结构：

MOV    EAX,<我要取的数组元素的下标>

IMUL   EAX,EAX,<结构的大小>

MOV    ECX,<结构数组开始的地址>

MOV    EAX,DWORD PTR[ECX,EAX]    ;取得数组元素的内容放到EAX中